CVE-2026-9484 Overview
CVE-2026-9484 is an improper authorization vulnerability [CWE-266] in SourceCodester Student Grades Management System 1.0. The flaw resides in the getClassroomStudents and removeStudentFromClassroom functions within classroom.php. Attackers manipulate the classroom_id argument to access or modify classroom data outside their authorized scope. The attack works remotely over the network and requires only low-privilege authentication. Public disclosure of the exploit increases the likelihood of opportunistic abuse against exposed installations.
Critical Impact
Authenticated remote attackers can enumerate student records and remove students from classrooms they do not own, breaking the authorization model of the application.
Affected Products
- SourceCodester Student Grades Management System 1.0
- classroom.php component — getClassroomStudents function
- classroom.php component — removeStudentFromClassroom function
Discovery Timeline
- 2026-05-25 - CVE-2026-9484 published to NVD
- 2026-05-26 - Last updated in NVD database
Technical Details for CVE-2026-9484
Vulnerability Analysis
The vulnerability exists in classroom.php, which exposes the getClassroomStudents and removeStudentFromClassroom functions. Both functions accept a classroom_id parameter supplied by the client. The server-side logic fails to verify whether the authenticated user owns or has permission to act on the referenced classroom. As a result, any logged-in user can substitute another classroom's identifier and trigger the function against records belonging to a different teacher or administrator.
The vulnerability is classified under [CWE-266] Incorrect Privilege Assignment. The attack is launched remotely without user interaction, and the exploit has been publicly disclosed through the referenced GitHub Vulnerability Report.
Root Cause
The root cause is missing authorization checks between authentication and resource access. The application authenticates the session but does not bind classroom_id values to the authenticated user's permitted classroom set. This decoupling allows horizontal privilege abuse across classroom records.
Attack Vector
An authenticated attacker sends crafted HTTP requests to classroom.php containing a classroom_id value belonging to another user. The getClassroomStudents function returns the student roster for that classroom. The removeStudentFromClassroom function deletes the requested student association. No additional privileges or user interaction are required.
No verified exploitation code is published in structured form. Refer to the GitHub Vulnerability Report and VulDB entry 365465 for the disclosed proof-of-concept details.
Detection Methods for CVE-2026-9484
Indicators of Compromise
- Unexpected HTTP POST or GET requests to classroom.php referencing classroom_id values that do not match the authenticated session owner.
- Removal of student-to-classroom associations performed by accounts that do not own the affected classroom.
- Spikes in getClassroomStudents calls from a single authenticated user iterating through sequential classroom_id values.
Detection Strategies
- Enable verbose application logging on classroom.php to capture caller identity, requested classroom_id, and the function invoked.
- Correlate authenticated session identifiers with the ownership records of any classroom_id referenced in requests, and flag mismatches.
- Deploy web application firewall (WAF) rules that detect parameter enumeration patterns against classroom.php.
Monitoring Recommendations
- Monitor database audit logs for DELETE statements affecting classroom-student mappings outside of expected user scope.
- Alert on accounts generating high request volumes to classroom enumeration endpoints over short time windows.
- Review web server access logs for repeated requests to classroom.php containing incrementing numeric identifiers.
How to Mitigate CVE-2026-9484
Immediate Actions Required
- Restrict network access to the Student Grades Management System to trusted networks until a fix is applied.
- Audit current classroom-student associations to identify unauthorized removals or disclosures.
- Force password resets for low-privilege accounts that may be leveraged for exploitation.
Patch Information
No vendor patch is referenced in the published advisory. SourceCodester has not issued a fixed release for Student Grades Management System 1.0 at the time of disclosure. Administrators should monitor the SourceCodester project page and the VulDB record for update notifications.
Workarounds
- Add server-side authorization checks in classroom.php that validate the authenticated user owns the supplied classroom_id before executing getClassroomStudents or removeStudentFromClassroom.
- Implement indirect object references by mapping internal classroom_id values to per-session tokens.
- Disable the affected endpoints if the classroom management feature is not actively used.
- Place the application behind an authenticating reverse proxy that enforces role-based access lists.
# Example server-side authorization check to add in classroom.php
# Verify the requested classroom_id belongs to the authenticated user
# before executing getClassroomStudents or removeStudentFromClassroom
#
# SELECT 1 FROM classrooms
# WHERE id = :classroom_id
# AND owner_user_id = :session_user_id;
#
# If no row is returned, reject the request with HTTP 403.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
